RHSA-2026:27001HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.18.45 bug fix and security update

Published
June 24, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-34986 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:2c3c20d411d9dbd8d8ff63f4a81686b2dad19188becf266ec627348faa9c8970_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:539d18f0e1b083d07ce0eef447140943107f8e7eab77ed058988cddb188ea622_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:666afcb022282a789204526808111597f9f82d82ae3abd77183885ad8da18437_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9e57a4651dfd5d7f4c46f53d166832713aabf419e0d06c96d9d1164c6647c1af_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:16950dfe6a18eef42ac78a01746aabc1be5a7aba8d0d316e52dbe7ebfcae58dc_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:30b6d36bdc7b6eee70b45f967210c5c41bef221e50176018c3dbc0f8cbc46529_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:7b3f5b0f96bf7302f445582e5cc5e6c5f2f162f99b520ad4b5375a78038ae545_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:930552f7214cbea5bce49e01b693719f3dbb5a1cc9fe8f88baa2d59f11fb7d7b_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:3340f0847f23b78cff4fdf11c1e5a02a7235e4f485c35c2c5b7a9551198bba79_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:a0fa5b7d220463de3e5535ce9324d7b34a80525aefae77f9b9e38631dc7cfbf0_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:aaa9942fbb60d86027b1ccbbbb00a89f5206e2a825bfa296df00c1b21a97113a_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:e7885379488a3ec3422b9a388058ca8034d5f36ea8c96b78b5684e05f92974ac_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2a374f4f33286b6bd41906d5646924175ee09d591ab9dfaf196334629f0f91e6_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:37e2a1dd19b4af867ee20aa471047fa547494f5af90db704f7e6aa109e26dc0e_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:60645e90ce40aff947ec45bae63facbb491adbee8617582be2e3255eeede2632_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c9f15c3ba5404618510581a47e3378ca80224c5d801e311cd201ece78efe747d_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0082f0711dc378cd66d1d4daea2c3d5319552037b03c11c6f033850f08a2a4d8_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2ec4d31e2977369a86aa779f971e03ba39d30135b5c8ba60f3d85de33640bd79_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5db27f5e6dee26b897402f3a6b7dc6e21f1e96e7e3b1915b9b421b4dcc0a3dd4_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:642281d34b4260919936e72ffc26ceb25f3f0407efcbf00d1d76af1bdeaa5e91_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:895dfb7203329f2eb741d16a2a51c08858d4cca09b7845ac8917e507985bc456_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:91aa38f8a3760e4145b37feaef184d0451f4498eadf38bf26d8e29fd73191b35_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:971ead2240892a3d37568ffc76d68cd4be96dda1f06fb67205c8b861156adb27_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:fa7757f0c872f29cdd2699576116059b97b6bf526b3933ceb4947339893f8e6f_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2352184eb81152269e491ebd262cbdfa91f137b6705cd5bd5c87fc86ee4a4330_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:a29c51d864e5813e4fea20cccf10b4eb7a739984b803bafb35e3051455c912ed_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:c82ac44aa2317fff98e514328c525f9725606bdf576b4b8ddcc429c16b75968e_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:fe3327f99397077257dfe453070e36a1fbb364b4080a4dc53f6695480838b6ae_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/insights-runtime-exporter-rhel9@sha256:0812fcff72badfded06f1b1bd5350a694f4f9bbe616ae77b33262f2932325297_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:67c63abae7a1baa34c48c1223c555322b7f9113eb3373f7e9575db43ce24c8d8 (For s390x architecture) The image digest is sha256:72e912eecbaef66cd3fca455fdaad9589be3509a1da96c6521aad57f5950fe9a (For ppc64le architecture) The image digest is sha256:2d57b8a652a5df4acbabf0e3d408de2e4e67a509b62d4a1ea8553eccc5d68973 (For aarch64 architecture) The image digest is sha256:0cbb059d26d4691a2742d3fb84fb8b18ceb959e4439a2a135e6bb88875c61081 All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)